Static task
static1
Behavioral task
behavioral1
Sample
dpapimig.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
dpapimig.exe
Resource
win10v2004-20231023-en
General
-
Target
dpapimig.exe
-
Size
73KB
-
MD5
1ee7875e0d26b013cb6c421382e403df
-
SHA1
c41a1aa21386b1a7c01ff2ad3cbe8b507217ee2d
-
SHA256
77a9dec390619c80d99d13f3629749663dfc3bc10e866604ff5ce5cc594697ec
-
SHA512
c4bb8f37227a1d48c4beecfeab405fd5d019a1bc2dea881db407841a678b71d1f3552ad6dba5f008c9320c6d99f206fff378260cb21cf5958a9aa8fcb6dd3b2c
-
SSDEEP
1536:eAU8vw6svPOCG00l3uU1HIED1fCbWpygzU:eb84luC1SJj16bE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dpapimig.exe
Files
-
dpapimig.exe.exe windows:6 windows x64
a37fa874d377a052ac83f907689fa7fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
GetSidIdentifierAuthority
OpenProcessToken
GetSidSubAuthority
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
CopySid
ConvertStringSidToSidW
RegDeleteTreeW
RegEnumValueW
IsValidSid
RegOpenKeyExW
GetLengthSid
RegEnumKeyExW
ConvertSidToStringSidW
RegCloseKey
kernel32
GetCurrentProcess
GetCurrentThread
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CompareStringOrdinal
TerminateProcess
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
LocalFree
CloseHandle
LocalAlloc
GetLastError
GetCommandLineW
user32
MessageBoxW
LoadStringW
LoadIconW
PostMessageW
msvcrt
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
??2@YAPEAX_K@Z
wcsncmp
??3@YAXPEAX@Z
_acmdln
memset
crypt32
CryptUpdateProtectedState
ole32
CoInitialize
CoUninitialize
comctl32
ord345
PropertySheetW
shell32
CommandLineToArgvW
netapi32
NetApiBufferFree
NetUserModalsGet
dui70
StrToID
?Click@Button@DirectUI@@SA?AVUID@@XZ
InitProcessPriv
UnInitProcessPriv
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
UnInitThread
??0TaskPage@DirectUI@@QEAA@XZ
??1TaskPage@DirectUI@@UEAA@XZ
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ
InitThread
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?SetMaxLength@Edit@DirectUI@@QEAAJH@Z
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z
?OnQueryCancel@TaskPage@DirectUI@@MEAA_JXZ
?OnReset@TaskPage@DirectUI@@MEAA_JXZ
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z
?OnWizBack@TaskPage@DirectUI@@MEAA_JXZ
?OnWizFinish@TaskPage@DirectUI@@MEAA_JXZ
?OnWizNext@TaskPage@DirectUI@@MEAA_JXZ
?OnMessage@TaskPage@DirectUI@@MEAA_NI_K_JPEA_J@Z
?OnQueryInitialFocus@TaskPage@DirectUI@@MEAAPEAVElement@2@XZ
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ